JVN#15201064: Multiple vulnerabilities in CG-WGR1200

CG-WGR1200 provided by Corega Inc is a wireless LAN router. CG-WGR1200 contains multiple vulnerabilities listed below.

Buffer Overflow (CWE-119) - CVE-2017-10852

Buffer Overflow (CWE-78) - CVE-2017-10853

Authentication bypass (CWE-306) - CVE-2017-10854

Impact

• A user with access to the affected device may execute arbitrary code － CVE-2017-10852
• A user with access to the affected device may execute an arbitrary command － CVE-2017-10853
• A user with access to the affected device may change the login password. As a result, the user may access the management screen of the device and perform an arbitrary operation such as altering the device’s settings － CVE-2017-10854

Solution

Do not use CG-WGR1200
Stop using CG-WGR1200. According to the developer, there is no plan to provide fix for these vulnerabilities since CG-WGR1200 is no longer supported.

Apply a Workaround
CG-WGR1200 is no longer supported and there is no plan of the fixes for these vulnerabilities being provided. However if you continue to use the device, apply following workarounds to mitigate the impacts of these vulnerabilities.

• Disable remote connection function to prevent an attacker’s remote access to the device
• Prevent unauthorized access from inside the LAN to the device.

Products Affected

• CG-WGR1200 firmware 2.20 and earlier